Add generic-webhook-trigger to ceph/ceph PR jobs for ci-approved label

[djgalloway]

What

Every active job that runs on `ceph/ceph` pull requests via the `github-pull-request` (ghprb) trigger now also accepts a `generic-webhook-trigger` (modeled on `ceph-trigger-build`), so a build can be triggered by adding a `ci-approved` label to the PR. 13 definition files:

ceph-pull-requests, ceph-pull-requests-arm64, ceph-pr-api, ceph-pr-commits, ceph-pr-submodules, ceph-pr-docs, ceph-dashboard-pull-requests, ceph-dashboard-cephadm-e2e, ceph-perf-pull-requests, ceph-rook-e2e, ceph-volume-unit-tests, ceph-volume-cephadm-prs, ceph-windows-pull-requests

Jobs watching other repos are intentionally not included.

How it works

• The trigger filters on `$action $label $ghprbPullId` matching `^labeled ci-approved \d+$` — it only fires when a `ci-approved` label is added to a pull request. Including `$.pull_request.number` in the filter prevents issue-label events from matching.
• It contributes the ghprb-equivalent variables (`ghprbPullId`, `ghprbTargetBranch`, `ghprbSourceBranch`, `ghprbActualCommit`, `sha1`) from the webhook payload, so existing SCM refspecs (`+refs/pull/${ghprbPullId}/*`) and `${sha1}` branch specs resolve unchanged.
• All 13 jobs share `token-credential-id: ci-approved-trigger-token` — the same random-secret-token model as `ceph-trigger-build`, so no plugin whitelist/HMAC config is needed; the unguessable token is the authentication. One `ceph/ceph` webhook pointed at `/generic-webhook-trigger/invoke?token=` (content type `application/json`, "Pull requests" events only) fans out to all 13 jobs when the label is added.
• The existing ghprb triggers are untouched — PR open/push/trigger-phrase behavior is unchanged; the label path is purely additive. Removing and re-adding the label re-triggers builds.

Before this takes effect

1. Create a Secret Text credential in Jenkins with ID `ci-approved-trigger-token` holding a random token (e.g. `pwgen 32 1`).
2. Add the `ceph/ceph` webhook with that token in the URL, JSON content type, "Pull requests" events only.

Reviewer notes

• `sha1` is set to `$.pull_request.head.sha` (the PR head), since the payload has no equivalent of ghprb's `origin/pr/N/merge` ref — label-triggered builds test the PR head rather than the merge preview.
• Only users with triage+ repo access can add labels on GitHub; ceph/ceph has no outside collaborators with triage or higher.
• All modified files validated with `jenkins-jobs test` (JJB 6.4.2).